394c060199c6bf03c47dedc8a5f3660b87b92977ba9981c75af947fbd91c5407

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 05:13

Target

275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe
Size

472KB
MD5

275dd5e03a36c002437b7a4028da51f1
SHA1

82c7c4d78f40fa53ad43adafdd34ce10a00da5bc
SHA256

394c060199c6bf03c47dedc8a5f3660b87b92977ba9981c75af947fbd91c5407
SHA512

efaaebd95474a9e5f0eae747083a5ec2e2f86d839c86e1753787d1c5a776b38e8586857ab7f08d2c80bd1d22e53f2be33b5f31aca330821b48f6dcb72519fbcd
SSDEEP

6144:In1jLWsHtBct/3vzgKrFx18ZJLPv72o2t6UZWeqbEnyZ:cLWrzgCIZsJ6UZWeqYnyZ

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe
1052	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\275dd5e03a36c002437b7a4028da51f1_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1052

memory/1052-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1052-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1052-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download